namespace SysDbg
{
	NTSTATUS ReadProcVirtualMemory(SYSDBG_VIRTUAL Data)
	{
	   NTSTATUS       Status = -1;
	   ULONG          ReturnLength;
	   if(NT_SUCCESS(NtSystemDebugControl(SysDbgReadVirtual,&Data,sizeof(SYSDBG_VIRTUAL),NULL,0,&ReturnLength)))
	   {
		   return Status;
	   }
	   return Status;
	}
	NTSTATUS WriteProcVirtualMemory(SYSDBG_VIRTUAL Data)
	{
	   NTSTATUS       Status = -1;
	   ULONG          ReturnLength;
	   if(NT_SUCCESS(NtSystemDebugControl(SysDbgWriteVirtual,&Data,sizeof(SYSDBG_VIRTUAL),NULL,0,&ReturnLength)))
	   {
		   return Status;
	   }
	   return Status;
	}
	ULONG GetCurrentEThread_XP( void ) 
	{ 
		SYSDBG_VIRTUAL ThreadData = {0}; 
		ULONG Buffer = 0; 
		ULONG ReturnLength = 0; 
		NTSTATUS  Status;
		BOOLEAN Enabled = 0;
	// This will enable NtSystemDebugControl usage 
		Status = RtlAdjustPrivilege( 20L ,true,false,&Enabled); 
		ZeroMemory((PVOID)&ThreadData, sizeof(SYSDBG_VIRTUAL)); 
	    ThreadData.Address   = (PVOID)(0xffdff000+0x124);//Read CurrentThread from KPRCB+0x4 
	    ThreadData.Buffer      = &Buffer; 
	    ThreadData.Request   = sizeof(ULONG); 
	    Status = ReadProcVirtualMemory(ThreadData);    
	    if(NT_SUCCESS(Status)) 
	    {
			return Buffer; 
		} 
		return 0;     
	} 
	ULONG GetServiceTable_XP( void ) 
	{ 
	   SYSDBG_VIRTUAL ThreadData;
	   ULONG Buffer = 0;
	   NTSTATUS      Status; 
	   ULONG EThread = GetCurrentEThread_XP(); 
	   if(EThread) 
	   { 
	      ThreadData.Address = (PVOID)(EThread+0xe0); 
	      ThreadData.Buffer  = &Buffer; 
	      ThreadData.Request = sizeof(ULONG); 
	      Status = ReadProcVirtualMemory(ThreadData);  
	      if(NT_SUCCESS(Status)) 
	      { 
	         return Buffer; 
	      } 
	   } 
	   return 0; 
	}
}
 
